Develop

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      # The archive decoders parse untrusted user-uploaded bytes; keep them
+      # together so a security bump lands as one reviewable change. Groups
+      # cover version updates only unless applies-to says otherwise, so the
+      # security updates these exist for need their own entry.
+      archive-decoders:
+        patterns:
+          - github.com/bodgit/*
+          - github.com/nwaples/rardecode/*
+          - github.com/dsnet/compress
+          - github.com/ulikunitz/xz
+          - github.com/klauspost/compress
+      archive-decoders-security:
+        applies-to: security-updates
+        patterns:
+          - github.com/bodgit/*
+          - github.com/nwaples/rardecode/*
+          - github.com/dsnet/compress
+          - github.com/ulikunitz/xz
+          - github.com/klauspost/compress
+      aws:
+        patterns:
+          - github.com/aws/*
+      otel:
+        patterns:
+          - go.opentelemetry.io/*
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/test.yml

@@ -14,18 +14,29 @@ jobs:
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          # Nothing here pushes back, so the job has no use for the token
+          # checkout would otherwise leave in .git/config for every later step.
+          persist-credentials: false
+
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v6
         with:
-          stable: false
           go-version: ${{ matrix.go-version }}
 
-      - name: Checkout code
-        uses: actions/checkout@v2
-
       - name: Set up dependencies
         run: go mod download
 
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: ${{ matrix.go-version }}
+          # The code is already checked out above; the action's own checkout
+          # would only redo it and re-persist the credentials.
+          repo-checkout: false
+
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
@@ -53,13 +64,16 @@ jobs:
   test-cache:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v6
         with:
           go-version: 1.26.x
 
-      - name: Checkout code
-        uses: actions/checkout@v2
       - uses: actions/cache@v4
         with:
           # In order:

README.md

@@ -4,6 +4,30 @@
 
 The server management daemon
 
+The daemon communicates with the GameAP panel over gRPC only: it opens an
+outbound connection to the panel and keeps a bidirectional stream for tasks,
+server statuses, file transfers, console access and metrics. The daemon does
+not listen for incoming connections from the panel.
+
+## Enrollment
+
+The easiest way to connect a node is the enroll command. It contacts the
+panel with a setup key, downloads the TLS certificates and writes a ready
+config file:
+
+```bash
+gameap-daemon enroll --connect grpc://panel.example.com:31718/<setup-key>
+```
+
+| Flag            | Default                                  | Info
+|-----------------|------------------------------------------|------------
+| --connect       | (required)                               | Connect URL (grpc://host:port/setupKey)
+| --config-path   | /etc/gameap-daemon/gameap-daemon.yaml    | Path to write the config file
+| --certs-dir     | /etc/gameap-daemon/certs                 | Directory to save TLS certificates
+| --listen-ip     | 0.0.0.0 (auto-detected outbound IP)      | Node IP reported to the panel
+| --listen-port   | 31717                                    | Node port reported to the panel
+| --work-path     | /srv/gameap                              | Working directory for game servers
+
 ## Configuration
 
 Configuration file: gameap-daemon.yaml
@@ -13,14 +37,26 @@ Configuration file: gameap-daemon.yaml
 | Parameter                 | Required              | Type      | Info
 |---------------------------|-----------------------|-----------|------------
 | ds_id                     | yes                   | integer   | Dedicated Server ID
-| listen_ip                 | no (default "0.0.0.0")| string    | Listen IP
-| listen_port               | no (default 31717)    | integer   | Listen port
-| api_host                  | yes                   | string    | API Host
-| api_key                   | yes                   | string    | API Key
-| log_level                 | no                    | string    | Logging level (verbose, debug, info, warning, error, fatal)
+| api_key                   | yes                   | string    | API Key (sent in the gRPC registration)
+| api_host                  | deprecated            | string    | Fallback source for the gRPC address (host:31718) and insecure transport detection (`http://` prefix). Prefer `grpc.address` / `grpc.insecure`
+| log_level                 | no                    | string    | Logging level (trace, debug, info, warning, error, fatal)
+
+### gRPC connection
+
+Either `grpc.address` or the deprecated `api_host` must be set.
 
+| Parameter                     | Required              | Type      | Info
+|-------------------------------|-----------------------|-----------|------------
+| grpc.address                  | yes*                  | string    | Panel gRPC endpoint (host:port)
+| grpc.insecure                 | no (default false)    | boolean   | Disable TLS (plaintext connection)
+| grpc.heartbeat_interval       | no (default 30s)      | duration  | Heartbeat period
+| grpc.connect_timeout          | no (default 30s)      | duration  | Dial timeout
+| grpc.initial_reconnect_delay  | no (default 1s)       | duration  | First reconnect delay
+| grpc.max_reconnect_delay      | no (default 60s)      | duration  | Reconnect delay cap
 
-### SSL/TLS
+\* If `grpc.address` is empty, the address is derived from `api_host` as host:31718.
+
+### SSL/TLS (mTLS for the gRPC connection)
 
 Certificates can be specified either as file paths or as inline PEM values.
 If both are set, inline values take precedence over file paths.
@@ -33,7 +69,6 @@ If both are set, inline values take precedence over file paths.
 | certificate_chain_file    | yes*                  | string    | Path to Server Certificate file
 | private_key_file          | yes*                  | string    | Path to Server Private Key file
 | private_key_password      | no                    | string    | Server Private Key Password
-| dh_file                   | no                    | string    | Path to Diffie-Hellman file
 
 #### Inline PEM values
 
@@ -43,7 +78,9 @@ If both are set, inline values take precedence over file paths.
 | certificate_chain         | yes*                  | string    | Server Certificate PEM
 | private_key               | yes*                  | string    | Server Private Key PEM
 
-\* For each certificate, either the file path or the inline PEM value must be provided.
+\* For each certificate, either the file path or the inline PEM value must be
+provided. Not required when the connection is insecure (`grpc.insecure: true`
+or an `http://` `api_host`).
 
 Inline PEM example:
 ```yaml
@@ -64,22 +101,12 @@ private_key: |
   -----END PRIVATE KEY-----
 ```
 
-### Base Authentification
-
-| Parameter                 | Required              | Type      | Info
-|---------------------------|-----------------------|-----------|------------
-| password_authentication   | no                    | boolean   | Login+password authentification
-| daemon_login              | no                    | string     | Login. On Linux if empty or not set will be used Linux PAM
-| daemon_password           | no                    | string    | Password. On Linux if empty or not set will be used Linux PAM
-
-### Stats
+### Metrics filters
 
 | Parameter                 | Required              | Type      | Info
 |---------------------------|-----------------------|-----------|------------
 | if_list                   | no                    | list      | Network interfaces to report. Empty/unset = physical, non-loopback interfaces only
 | drives_list               | no                    | list      | Disk mounts to report. Empty/unset = root `/` plus the work_path drive
-| stats_update_period       | no                    | integer   | Stats update period
-| stats_db_update_period    | no                    | integer   | Update database period
 
 ### Steam
 
@@ -113,5 +140,15 @@ the daemon does not run as `root`.
 
 | Parameter                 | Required              | Type      | Info
 |---------------------------|-----------------------|-----------|------------
-| 7zip_path                 | no                    | string    | Path to 7zip file archiver. Example: "C:\Program Files\7-Zip\7z.exe"
-| starter_path              | no                    | string    | Path to GameAP Starter. Example: "C:\gameap\gameap-starter.exe"
+| path_7zip                 | no                    | string    | Path to 7zip file archiver. Example: "C:\Program Files\7-Zip\7z.exe"
+| path_starter              | no                    | string    | Path to GameAP Starter. Example: "C:\gameap\gameap-starter.exe"
+
+### Removed configuration keys
+
+The legacy protocols (the inbound binn/TLS listener and the HTTP REST API
+client) have been removed, the daemon is gRPC-only now. The following keys
+are ignored if present in a config file (unknown keys do not cause errors):
+
+`listen_ip`, `listen_port`, `daemon_login`, `daemon_password`,
+`password_authentication`, `dh_file`, `stats_update_period`,
+`stats_db_update_period`, `grpc.enabled`, `task_manager.update_period`